Google Pay harassment: complaint, evidence and the law

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber crime

Repeated payment requests carrying abuse, threats or obscene notes on Google Pay are criminal conduct, not merely bad manners. Each request leaves a UTR, a timestamp and a sender handle that the bank can trace. The applicable provisions are Sections 351, 78 and 79 of the BNS, 2023 and Sections 67 and 67A of the IT Act, 2000.

Google Pay has a feature nobody designed for harassment and everybody has discovered: the payment request. A stranger can send you a request for one rupee with a message attached, and the message appears on your phone as a notification with the sender's name. Repeat it fifty times in an evening and you have a campaign of abuse delivered through a payment channel, complete with a receipt.

Victims often assume nothing can be done because no money was taken. The opposite is true. Harassment through a payment app generates better evidence than almost any other kind of online abuse: every request has a reference number, a timestamp, a sender VPA and a bank-side record that can be subpoenaed. The difficulty is not proof. It is that complainants delete the messages, block the sender and thereby destroy the trail before anyone with authority sees it.

What the conduct actually is, in law

The first question a lawyer asks is what was sent, because the section follows the content, not the platform.

Threats. A demand for money backed by a threat — of harm, of publishing something, of sending people to your house — is criminal intimidation under Section 351 of the Bharatiya Nyaya Sanhita, 2023. Where the threat is of death or grievous hurt, or is intended to compel a person to part with property, Section 351(3) applies and the offence carries up to seven years. A threat made through a computer resource does not become a different offence; the IT Act does not displace the penal provision.

Obscene material. If the notes, images sent through a linked chat, or profile names are obscene, Section 67 of the Information Technology Act, 2000 applies to publishing or transmitting obscene material in electronic form, with up to three years and a fine up to five lakh rupees on first conviction. Where the material is sexually explicit, Section 67A applies with a higher range. Section 67 is not limited to websites; a direct transmission to one person is covered.

Harassment of a woman. Persistent unwanted contact with a woman despite a clear indication of disinterest is stalking under Section 78 of the BNS, which expressly covers monitoring or attempting to monitor a woman's use of the internet, email or other electronic communication. Sending words or images intended to insult her modesty is a separate offence under Section 79 of the BNS.

Impersonation and identity. Where the sender is using a false identity, a rented account or someone else's credentials, Section 66D of the IT Act (cheating by personation using a computer resource) and Section 66C (identity theft) become available. Where a private image was obtained or transmitted without consent, Section 66E addresses violation of privacy.

And where the statements are false and damaging, Section 356 of the BNS covers defamation, which in the online context is prosecuted far less often than it is threatened and is usually better pursued civilly.

A payment request is not an anonymous act. The sender's VPA is registered against a bank account opened with KYC. That is the structural difference between abuse on a payment app and abuse on an anonymous forum.

What to do, in order

Do not delete anything and do not reply. Replying confirms the number is live and gives the sender a reason to continue. Deleting removes the only record you have.
Capture the evidence properly. Record the screen while the notification appears, so the timestamp is captured in the same frame as the message. Then open the transaction detail and capture the reference number. Do not crop.
Write a log. Date, time, sender name and VPA as displayed, exact wording, and the reference number. Maintain it as a single document; a chronological log is far more persuasive than a folder of images.
Use the in-app controls. Google Pay allows you to decline, block and report a sender. Reporting feeds the platform's fraud systems but is not a legal complaint and does not preserve anything you have not already captured.
Inform your bank in writing. Ask for the UPI handle to be noted as a source of harassment. The bank cannot block a third party's account on your word, but the letter creates a dated record and the bank can flag the VPA.
Complain to the cyber crime cell. Use cybercrime.gov.in under 'Report Other Cyber Crime', or the local cyber cell. Harassment, threats and obscene transmission are cognizable offences and an FIR can be registered under Section 173 of the BNSS, 2023.
If the police will not act, go to the magistrate. Under Section 175(3) of the BNSS a complaint may be made to the jurisdictional magistrate, who can direct an investigation. A private complaint for defamation lies to the magistrate in any event.

The platform's duties, and why they rarely help you directly

Google Pay, as a payment system participant, sits within a regulatory structure rather than the intermediary safe-harbour regime that governs social media. Its obligations flow from NPCI's operating rules, the RBI's digital payment security directions, and the grievance redressal requirements that apply to payment system operators. In practice that means a complaint to the platform produces account-level action — restriction, suspension — and a paper trail, but not an investigation into the person sending the messages.

That is why the bank and the police matter more than the app's report button. The bank holds the KYC. The police can demand it. The platform can only act on its own account.

Matching the conduct to the forum

What was sent	Provision	Where to take it
Repeated requests after being asked to stop	Section 78 BNS (where the recipient is a woman), Section 351 BNS if coupled with a demand	Cyber cell; magistrate if police decline
Threat of harm or of exposing something private	Section 351(3) BNS	Police station; FIR
Obscene words, images or profile names	Section 67 IT Act; Section 79 BNS where the recipient is a woman	Cyber cell; cybercrime.gov.in
Private images shared without consent	Section 66E IT Act; Section 67A where explicit	Cyber cell, urgently; preservation request to platform
Fake identity or rented account	Sections 66C and 66D IT Act	Police; bank fraud desk
False statements damaging reputation	Section 356 BNS, or a civil defamation suit	Magistrate, or civil court for damages and injunction

Evidence that survives scrutiny

Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, electronic records are proved by producing the device or medium together with a certificate that identifies the record and addresses the integrity of its production. Investigators and courts have become strict about this, and the practical consequence for a complainant is that a forwarded screenshot is weak while a screen recording made on the original handset is strong.

Three further points are worth building into your file from the first day. Keep the handset and do not factory reset it. Keep the SIM active, because the number is the link between the VPA and you. And keep the abusive messages in the app itself rather than only as exported images, since the app's own record is what a Section 63 certificate will eventually authenticate.

Where the sender's identity is masked, the police can seek subscriber and KYC details from the bank and the platform. That is a routine request in a registered case and close to impossible without one, which is the single strongest practical argument for insisting on an FIR rather than settling for a general diary entry.

What decides whether a case goes anywhere

Whether there is a pattern or an isolated message. One rude note is unpleasant but hard to prosecute. Fifty in a week, or a sequence that escalates after a refusal, is a course of conduct and reads as harassment.

Whether a demand accompanied the abuse. A demand for money, for a meeting, or for the withdrawal of a complaint converts abuse into extortion or intimidation and lifts the case out of the summary category.

Whether the content is sexual or threatening. Both attract higher punishments and both are taken up more readily by cyber cells than generic abuse.

Whether the sender can be identified. A VPA registered to a real person with KYC is traceable. A VPA registered to a mule is not, and cases against mules rarely produce a conviction for harassment because the mule did not send the messages.

Whether the complainant's own conduct is clean. If you replied with abuse of your own, expect the defence to use it. This is not fair, but it is what happens.

Mistakes that weaken the case

Blocking before capturing. Blocking hides the history and the reference numbers with it.
Arguing back. It supplies the other side with material and confirms your number is active.
Complaining on social media first. Public posts can be defamatory if the sender is identifiable, and they compromise the investigation.
Filing only with the app. No statutory record, no power to obtain KYC.
Waiting for the abuse to 'blow over'. Escalation is the norm, not the exception, and the pattern is the strongest part of the case.

If the harassment is connected to a dispute over money — a loan, a failed deal, a jilted arrangement — the payment messages are often the tip of a larger extortion attempt, and the case is better built as one. A cyber crime lawyer in Kolkata can assess whether the messages amount to intimidation, whether a civil injunction is worth seeking, and how to frame the complaint so that the police register the right sections rather than a vague entry about a money dispute. If the conduct also involves defamatory posts elsewhere, the approach described for criminal defence and complaint work applies to the counter-case as well.

When to involve a lawyer

If the abuse is recent, limited and stopped when you blocked the sender, capturing the evidence and filing a police complaint is enough. A lawyer becomes necessary when the police treat the matter as a civil dispute, when the sender is using multiple handles, when a private complaint before a magistrate is the only remaining route, or when you have been accused of harassment in return. Defamation and privacy claims are also worth a considered view before you post anything publicly about the person, because that is how complainants become defendants.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Is sending abusive payment requests on Google Pay a crime in India?

Yes, depending on the content. Repeated unwanted contact is stalking under Section 78 of the BNS where the recipient is a woman, threats are criminal intimidation under Section 351, obscene material falls under Section 67 of the IT Act, and a demand backed by a threat can attract up to seven years under Section 351(3).

How do I stop someone from sending me payment requests on Google Pay?

Capture the requests first, then use the block and report options in the app for that sender. Blocking stops further requests but also hides the transaction history, so record the reference numbers and screen recordings before you block, and inform your bank in writing so the handle is flagged.

Can police trace who is sending harassing UPI requests?

Yes, once a case is registered. Every request carries a reference, a timestamp and the sender's virtual payment address, which is linked to a bank account opened with KYC. Police can seek subscriber and account details from the bank and the platform, which is why an FIR matters more than an in-app report.

What evidence should I keep for a Google Pay harassment complaint?

Keep a screen recording showing the notification and the timestamp together, the transaction detail with its reference number, the sender's displayed name and VPA, and a written log of dates and exact wording. Preserve the handset without resetting it, because Section 63 of the BSA requires authentication of electronic records.

Can I file a harassment complaint if no money was actually taken?

Yes. The offence is the communication, not the loss. A payment request for one rupee carrying a threat or obscene message is complete without any transfer. Offences under Sections 351 and 78 of the BNS and Section 67 of the IT Act are cognizable, so an FIR can be registered regardless of value.

What can I do if the police refuse to register my complaint?

Send the substance of the complaint in writing to the Superintendent of Police under Section 173(4) of the BNSS, and if that fails, apply to the jurisdictional magistrate under Section 175(3). A magistrate can direct an investigation, and a private complaint for defamation can be filed before the magistrate in any event.

Is harassment through a payment app covered by the IT Act?

Partly. The IT Act covers obscene transmission under Sections 67 and 67A, privacy violations under Section 66E, and impersonation under Sections 66C and 66D. Threats and stalking are prosecuted under the BNS, and the two statutes are usually applied together rather than in place of each other.

Can I sue someone civilly for harassment on Google Pay?

Yes, a civil suit for damages and a permanent injunction is possible, particularly where the messages are defamatory or invade privacy. It is rarely the fastest remedy, and it usually follows a criminal complaint rather than replacing one, because the criminal case is what produces the sender's identity.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact